SAP Netweaver 'EPS_DELETE_FILE()' Arbitrary File Deletion Vulnerability

Bugtraq ID:	49321
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 22 2011 12:00AM
Updated:	Aug 22 2011 12:00AM
Credit:	Alexey Sintsov
Vulnerable:	SAP NetWeaver 7.30 SAP NetWeaver 7.10 SAP NetWeaver 7.02 SAP NetWeaver 7.01 SAP NetWeaver 7.0 SP8 SAP NetWeaver 7.0 SP15 SAP NetWeaver 7.0
Not Vulnerable:

SAP Netweaver 'EPS_DELETE_FILE()' Arbitrary File Deletion Vulnerability

SAP Netweaver is prone to a vulnerability that lets attackers delete arbitrary files on an affected computer in the context of the Web server.

Attackers can exploit this issue with directory-traversal strings ('../') to delete arbitrary files; this may aid in launching further attacks.

SAP Netweaver 'EPS_DELETE_FILE()' Arbitrary File Deletion Vulnerability

Attackers can use a browser to exploit this issue.

SAP Netweaver 'EPS_DELETE_FILE()' Arbitrary File Deletion Vulnerability

Solution:
Updates are available. Please see the references for details.

SAP Netweaver 'EPS_DELETE_FILE()' Arbitrary File Deletion Vulnerability

References:

• [DSECRG-11-031] SAP RFC EPS_DELETE_FILE - Authorisation bypass, smbrelay (Digital Security Research Group)
  
• SAP Homepage (SAP)
  
• SAP NetWeaver EPS_DELETE_FILE RFC Function (SAP)
  
• SAP NetWeaver Homepage (SAP)